full disk encryption with luks on manjaro xfce

Code:
===================================

separate partitions for boot & root

===================================

boot to debian on emmc

create new partition layout using gparted 

 (boot will be on 1st partition & root on 2nd partition)

 resize mmcblk1p1 partition to smallest size to create free space 

 (don't touch ~31m unallocated space at start of sdcard)

    copy mmcblk1p1 & paste into remaining free space

   format mmcblk1p1 ext4 to delete files

   resize mmclk1p1 to your desired size, for me ~800mb

    (don't touch ~31m unallocated space at start of sdcard)

  label mmcblk1p1 BOOT

 resize/move mmcblk1p2 to fill all remaining free space

move files to /boot

 sudo mkdir /mnt/boot; sudo mount /dev/mmcblk1p1 /mnt/boot

    sudo mkdir /mnt/root; sudo mount /dev/mmcblk1p2 /mnt/root

    cd /mnt/boot

    sudo mv /mnt/root/boot/* /mnt/boot

set automount for boot partition

    sudo nano /mnt/root/etc/fstab

        /dev/mmcblk1p1 /boot ext4 defaults 0 2

configure bootloader

    get PARTUUID, for me its 781b2cf9-02

        sudo blkid|grep mmcblk1p2

    add PARTUUID for root and remove /boot/ folder from 3 lines

        cd /mnt/boot/

        sudo nano boot.txt

            #setenv bootargs console=ttyS2,1500000n8 root=PARTUUID=${uuid} rw rootwait bootsplash.bootfile=bootsplash-themes/manjaro/bootsplash append video=eDP-1:1920x1080@60

            setenv bootargs console=ttyS2,1500000n8 root=PARTUUID=781b2cf9-02 rw rootwait bootsplash.bootfile=bootsplash-themes/manjaro/bootsplash append video=eDP-1:1920x1080@60



            #if load ${devtype} ${devnum}:${bootpart} ${kernel_addr_r} /boot/Image; then

            if load ${devtype} ${devnum}:${bootpart} ${kernel_addr_r} Image; then

               #if load ${devtype} ${devnum}:${bootpart} ${fdt_addr_r} /boot/dtbs/${fdtfile}; then

               if load ${devtype} ${devnum}:${bootpart} ${fdt_addr_r} dtbs/${fdtfile}; then



                  #if load ${devtype} ${devnum}:${bootpart} ${ramdisk_addr_r} /boot/initramfs-linux.img; then

                  if load ${devtype} ${devnum}:${bootpart} ${ramdisk_addr_r} initramfs-linux.img; then



    sudo apt install u-boot-tools

    sudo ./mkscr

boot to manjaro on sdcard



============

encrypt root

============

boot to manjaro on sdcard

add modules & hooks to initram

 (the order the modules and hooks are loaded is important)

    sudo nano /etc/mkinitcpio.conf

        MODULES=(panfrost rockchipdrm drm_kms_helper hantro_vpu analogix_dp rockchip_rga panel_simple arc_uart cw2015_battery i2c-hid iscsi_boot_sysfs jsm pwm_bl uhid)

        BINARIES=()

        FILES=()

        HOOKS=(base udev keyboard autodetect keymap modconf block encrypt filesystems fsck)

        COMPRESSION="cat"        

    sudo mkinitcpio -P

boot to debian on emmc

encrypt existing partition in place with luks

    make sure mmcblk1p2 is not mounted

    sudo e2fsck -f /dev/mmcblk1p2

    sudo resize2fs -M /dev/mmcblk1p2

    sudo cryptsetup-reencrypt /dev/mmcblk1p2 --new --reduce-device-size 16M

    sudo cryptsetup open /dev/mmcblk1p2 cryptroot

    sudo resize2fs /dev/mapper/cryptroot

    sudo mount /dev/mapper/cryptroot /mnt/root

configure bootloader

    get UUID for mmcblk1p2

    sudo blkid|grep mmcblk1p2

        get UUID root, for me its 6d1c2895-f2c2-477f-8415-b04f7a4641da

    change kernel parameters for encrypted root including display to console & disable splash

        sudo mount /dev/mmcblk1p1 /mnt/boot

        cd /mnt/boot

        sudo nano boot.txt

            # setenv bootargs console=ttyS2,1500000n8 root=PARTUUID=781b2cf9-02 rw rootwait bootsplash.bootfile=bootsplash-themes/manjaro/bootsplash append video=eDP-1:1920x1080@60

            setenv bootargs console=tty1 root=/dev/mapper/cryptroot cryptdevice=UUID=0d739f2d-92af-40ec-bd8b-c8f241e6a2ce:cryptroot:allow-discards rw rootwait quiet append video=eDP-1:1920x1080@60



            #booti ${kernel_addr_r} - ${fdt_addr_r};

            booti ${kernel_addr_r} ${ramdisk_addr_r}:${filesize} ${fdt_addr_r};



        sudo ./mkscr

reboot to manjaro on sdcard